Comment by debazel
14 hours ago
> but eventually we should start flagging images with no source attribution as dangerous the way we flag non-https.
Yes, lets make all images proprietary and locked behind big tech signatures. No more open source image editors or open hardware.
C2PA is actually an open protocol, à la SMTP. the whole spec is at https://spec.c2pa.org/, available for anyone to implement.
The standard itself being open is irrelevant. I'm not sure why this is always brought up for attestation standards. It is fundamentally impossible to trust the signature from open-source software or hardware, so a signature from open-source software is essentially the same as no signature.
The need for a trusted entity is even mentioned in your specification under the "attestation" section: https://spec.c2pa.org/specifications/specifications/1.4/atte...
So now, if we were to start marking all images that do not have a signature as "dangerous", you would have effectively created an enforcement mechanism in which the whole pipeline, from taking a photo to editing to publishing, can only be done with proprietary software and hardware.
Why would the image itself have to be proprietary to have some new piece of metadata attached to it ?